REDHAT-BUG-769721: Null Pointer Dereference
User space may create the PIT and forgets about setting up the irqchips. In that case, firing PIT IRQs will crash the host:
BUG: unable to handle kernel NULL pointer dereference at 0000000000000128 IP: [<ffffffffa10f6280>] kvmsetirq+0x30/0x170 [kvm] ... Call Trace: [<ffffffffa11228c1>] pitdowork+0x51/0xd0 [kvm] [<ffffffff81071431>] processonework+0x111/0x4d0 [<ffffffff81071bb2>] workerthread+0x152/0x340 [<ffffffff81075c8e>] kthread+0x7e/0x90 [<ffffffff815a4474>] kernelthreadhelper+0x4/0x10
Reference: http://permalink.gmane.org/gmane.comp.emulators.kvm.devel/83564
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
KVM hosts are exposed when user space creates a programmable interval timer (PIT) but does not set up the associated irqchips. The issue affects the host kernel rather than only the guest.
What is required to trigger the crash?
An attacker or user needs to be able to create this incomplete KVM device configuration and cause PIT interrupts to fire. Firing those interrupts can lead KVM to dereference a null pointer and crash the host.
How can administrators recognize a possible occurrence?
Affected hosts may crash with a kernel NULL pointer dereference in kvm_set_irq, with pit_do_work appearing in the call trace. The reported fault address is 0000000000000128.